Development discussion of WireGuard
 help / color / mirror / Atom feed
From: Stephen Larew <>
Subject: Re: Split DNS for macOS
Date: Thu, 27 Jan 2022 21:23:29 -0800	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

> On Oct 28, 2021, at 00:16, Stephen Larew <> wrote:
> For many months now, I have been running a patched WireGuard macOS app
> that enables a split DNS configuration. I would like to try to upstream
> my patches for split DNS.
> There has been some interest in this patch:
> - "Mac APP DNS Search Domain" thread from July and August 2021 [1]
> - A commenter on my GitHub fork of wireguard-apple.
> What is split DNS? It allows sending DNS queries to a specific server
> based on the domain name. Systemd-resolved calls it a routing domain.
> Apple's Network Extension framework calls it a match domain.  Split DNS
> is especially useful for internal DNS servers.
> For example, if is a routing domain for the DNS server
> at (only accessible over WireGuard), then
> is resolved using while
> is resolved using some other DNS resolver (depending on
> the other network settings in macOS).
> The proposed patch adds new syntax to the wg-quick DNS= line.
> Specifically, a tilde prefixed domain is treated as a routing domain.
> Multiple routing domains can be added.
> Limitations:
> - Needs modifications to iOS UI to work on iOS.
> - Only matching routing domains are sent to the DNS servers specified in
>  the DNS= config line.  No separate fallback catch-all DNS server can
>  be set.
> - Routing/match domains are also included in the list of search domains.
>  This could be changed with the matchDomainsNoSearch API, but lacking
>  more UI or config file changes to expose this option to the user, I
>  went with the default.
> [1]
> [2]

Thanks everyone for your opinions and feedback. Here’s my summary:

- DNS configuration is nuanced, fragmented, and platform dependent.

- Split DNS can be accomplished in several ways:
  - Via the native macOS DNS resolution machinery (NEDNSSettings.matchDomains in my patch)
  - Via a local or upstream non-platform-native DNS resolver

- Demand for split DNS exists. Other VPN apps (e.g. Tailscale and DNSCloak) allow setting split DNS.


I would appreciate some feedback from the WireGuard maintainers on next steps. Thanks ahead.

I’ll address some feedback below.

> On Nov 3, 2021, at 02:15, Harald Dunkel <> wrote:
> Hi folks,
> I really like this patch. Currently DNS on MacOS is unable to resolve
> both my local DNS names and the domain in the office in parallel, if
> Wireguard is enabled. I have to use somehost.local to fall back to
> zeroconf for my LAN as a workaround, which is pretty annoying.
> My suggestion would be to set SupplementalMatchDomains instead(!) of
> SearchDomains, using the current config file syntax without '~'. Since
> SupplementalMatchDomainsNoSearch is disabled by default, setting
> SupplementalMatchDomains is sufficient to configure both lists. See
> This has to be verified, of course.
> Regards
> Harri

Harri, it sounds to me like SupplementalMatchDomains is functionally the same as NEDNSSettings.matchDomains. The difference is that SupplementalMatchDomains is specified in Apple’s configuration profiles instead of thru the NEDNSSettings.matchDomains API (by way of a wg-quick syntax extension in my patch). If the WireGuard macOS app supported Apple’s configuration profiles (I don’t believe it does but I may be mistaken), then a configuration profile would conveniently avoid the extended wg-quick syntax in my patch. However, I think configuration profiles are less accessible to the average user.

> On Nov 3, 2021, at 14:34, Andrew Fried <> wrote:
> Basically, what I'm suggesting is that DNS servers handle DNS and wireguard handle routing/transport.  Adding VPN functionality to a nameserver or dns capabilities to Wireguard adds complexities that can be better handled elsewhere.
> What makes Wireguard so good is that it does one thing and does it really, really well.
> Andrew

Andrew, to your point, alternative DNS solutions exist and can be deployed in many ways.  WireGuard itself is not a DNS solution.  That said, wg-quick style configuration (used by the WireGuard macOS app) already does basic DNS configuration.  My patch adds a small extension to wg-quick syntax (tilde prefixed domains) to make certain split DNS scenarios possible.

Crucially, my patch actually integrates directly into macOS’s DNS machinery. No third party software or external network DNS servers need apply.

> On Nov 5, 2021, at 21:54, David Anderson <> wrote:
> Hi, Tailscale person here.

Dave, your technical details sound right based on what I remember from my own experimentation.


  parent reply	other threads:[~2022-01-28  5:23 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-28  7:16 Stephen Larew
2021-10-28  7:16 ` [PATCH] Enable "split DNS" configurations for an interface Stephen Larew
2021-10-28  9:58 ` Split DNS for macOS Bruce Ferrell
2021-10-29 15:33   ` Stephen Larew
2021-10-29 17:03     ` Andrew Fried
2021-10-29 21:07       ` Stephen Larew
2021-10-30 21:00         ` Dusan Zivadinovic
2021-11-03  9:15         ` Harald Dunkel
2021-11-03  9:42           ` Matty Driessen
2021-11-03 11:54         ` Alex Burke
2021-11-06  4:54         ` David Anderson
2021-11-06  9:47           ` Matty Driessen
2022-01-28  5:23 ` Stephen Larew [this message]
2022-01-28  9:02   ` Harald Dunkel
2021-10-29 21:06 Matty Driessen
2021-11-03 21:34 ` Andrew Fried
2021-11-03 21:46   ` Alex Burke

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).